thesis-engine

Iterate on a shipped product, one PR at a time. First-run bootstrap identifies the app type and interviews you for competitors + framework pins. Recommends the right mode (feature-add, competitive, ux-polish, bug-bash) for the moment; ships with regression-aware, small-diff posture. Includes radar (digest what's new), rate (score an idea before committing), spy (single-URL competitor read), scan-releases (per-lib changes since last bump), upgrade (surgical lib bumps with codemods when available), ship (hand-written brief, no ingestion). Composes with vibe-cartographer when installed (heavy-iteration delegation). Self-evolves via session + friction logging — :evolve-iterate proposes improvements based on your usage patterns. No telemetry.

Test analyzer and generator for vibe-coded apps. Classifies by app type and maturity tier, measures coverage honestly (no cherry-picked denominators), generates tests proportional to deployment risk — and catches the broken harnesses every other test tool assumes away.

Plot your course from idea to shipped app. Vibe coding course correction delivered as Claude Code slash commands: onboard, scope, prd, spec, checklist, build, iterate, reflect, reconnect, evolve-cart, tend, vitals, friction, coder-voice.

Bootstrap a 626Labs-pattern CLAUDE.md — the load-bearing structural file every agent decision in the repo rests on. Interviews the user for org, decision surface, voice rules, and persona before drafting, so the produced file reflects THEIR conventions, not 626Labs defaults baked in. Tenant-aware; adapts to repo type (code platform / marketing site / long-form writing / mixed). Use when starting a new repo or when an existing CLAUDE.md is stale.

Security gap finder for vibe-coded apps — the tier-aware security audit and orchestration layer. Defers to gitleaks/OSV-Scanner/Semgrep/Trivy when present, falls back to an in-house baseline when absent, and owns the tier classification (mapped to OWASP ASVS), severity calibration, four-band report, confidence-routed fixes with destructive-action overrides, and threat-model synthesis. /vibe-sec:audit runs the full twelve-concern audit (secrets, deps, supply-chain, config, crypto/PII, auth-model, OWASP survey, rate-limiting, license-compliance, data-posture, threat-model, tier-scoring) — plus :scan, :deps, :gate (CI-safe), :posture, :fix, :threat-model, and :research. License compliance is distribution-model aware: GPL in a shipped binary flags high, the dual-license OR-trap doesn't flag at all. Validated on real Firebase apps.

The prompt-engineering loop for your app's LLM features. /vibe-prompt:scan inventories every prompt site (registry and inline, TS/JS and Python, monorepo-aware); :audit fires 13 structural smells (F1-F13) scored on 5 dimensions, including the F10-F12 prompt-injection family; :eval behaviorally tests prompts against your production model with a calibrated LLM-judge (position-bias mitigation, verbosity penalty, optional jailbreak fixtures — cost-gated); :grade synthesizes composite grades with monotonic-baseline regression tracking; :remediate closes the audit-to-fix loop with confidence-routed diffs, backup, and rollback; :iterate proposes new AI features your app could ship next. Composer-aware across four composer kinds; injection findings hand off to vibe-sec. Validated on a real Next.js + Firebase + Gemini app, where it caught a live cross-vendor persona leak the master directive was supposed to prevent.

Session wrap-up that reads the breadcrumb trail your toolkit already left — not a cold reconstruction. Multi-repo aware: surfaces what shipped across every repo the session touched, what's uncommitted, and what's unpushed, then gates commit + push on the current repo only (read wide, mutate narrow). Six-section handoff written to docs/session-wraps/ and inline; every gate defaults to no-action with a second confirmation on secret-pattern matches. Pluggable decision log (Markdown / JSONL / 626Labs MCP / off). Self-evolving via session + friction logs. No telemetry.

Generate user onboarding for your app — but only when it earns one. Reads your UI surfaces, names the aha moment, and gives an honest verdict on whether a tour helps or hurts before building anything (don't-build is a first-class output). When warranted, generates a short, instrumented, replayable Driver.js spotlight tour with a human-gated data-tour anchor pass, a 6-event analytics adapter, and trigger wiring that reuses your app's existing first-run state. Emitted tours carry a keyboard/AT contract — focus return on close, escape hatch intact — enforced by emit-time assertions and a vitals check, not prose. Walkthrough mode for consumer apps; training mode comes later. Self-evolves via session + friction logging. No telemetry.

The deep retrospective for your Claude Code work — the verbose /insights over your full history and every machine you code on. Coverage, where-was-I recall, token/cost (incl. the cache reveal), trends, how-you-work (tool mix, delegation, per-machine), ranked open-threads with prune candidates, decisions, languages, per-session friction/satisfaction/outcome, and a synthesized narrative read. Personal by default; optionally keep chosen sources or repos local-only (the privacy wall). Standalone engine; optional cc-logs extra keeps token numbers aligned with sibling tools. MCP-agnostic decisions overlay. No telemetry.

AI-powered documentation gap analyzer. Scans your codebase, classifies your project, identifies missing technical documentation, and generates professional docs from your existing artifacts.